Privacy Policy
Last updated: September 2026
1. Who we are (Data Controller)
Vantum (“we”, “us”) operates vantum.cc — an algorithmic trading signal service. We are the data controller for personal data processed through this service.
Contact: privacy@vantum.cc
2. What data we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address | Authentication, signal delivery, billing | 6(1)(b) — contract performance |
| Hashed password | Account security | 6(1)(b) — contract performance |
| Telegram chat ID | Push notification delivery (only if you connect it) | 6(1)(b) — contract performance |
| Stripe customer / subscription ID | Billing and subscription management | 6(1)(b) — contract performance |
| Signal delivery logs | Prevent duplicate alerts, audit trail | 6(1)(f) — legitimate interest |
| Referral / UTM source | Understand which channels drive registrations | 6(1)(f) — legitimate interest |
| Upgrade nudge emails | Notify free-plan users of Pro features | 6(1)(f) — legitimate interest (can opt out in Settings) |
We do not collect IP addresses beyond what web servers log transiently. We do not build behavioural profiles.
3. Analytics
We use Vercel Analytics and Vercel Speed Insights to understand page traffic and performance. Both are cookieless and do not collect personally identifiable information. No cross-site tracking occurs. Aggregated, anonymised metrics only. Legal basis: Art. 6(1)(f) legitimate interest in improving the service.
4. Cookies
We set one cookie: vantum_session. It is HTTP-only, Secure, SameSite=Lax and expires after 30 days. It is strictly necessary to keep you logged in — no consent is required under ePrivacy Directive Art. 5(3).
Stripe sets its own cookies on checkout.stripe.com when you visit the checkout page. Those are Stripe's responsibility under their privacy policy. We have no access to those cookies.
See our Cookie Policy for full details.
5. Third-party processors
We share data with the following sub-processors only to the extent needed to operate the service:
- Resend — email delivery (US, SCCs in place)
- Stripe — payment processing (US, SCCs / EU-US DPF in place)
- Telegram — push notification delivery, only if you connect it (UAE)
- Neon — PostgreSQL database hosting (US, SOC 2 Type II, SCCs in place)
- Vercel — application and CDN hosting (US, SOC 2 Type II, SCCs in place)
We do not sell your data. We do not share your data with advertisers or data brokers.
6. Data retention
- Account data: retained while your account is active, deleted on account deletion
- Signal delivery logs: user FK anonymised on deletion; log records kept for 90 days then purged
- Billing records: retained for 7 years as required by financial regulations (stored by Stripe)
- Server access logs (Vercel): automatically purged after 30 days
7. Your rights under GDPR
If you are in the EEA, UK, or Switzerland, you have the following rights:
- Access (Art. 15) — request a copy of all data we hold about you. Use Settings → Export my data or email us.
- Rectification (Art. 16) — correct inaccurate data. Update your email in Settings or contact us.
- Erasure (Art. 17) — delete your account and all personal identifiers. Use Settings → Delete account.
- Portability (Art. 20) — receive your data in a machine-readable format (JSON). Use Settings → Export my data.
- Restriction (Art. 18) — ask us to stop processing your data while a dispute is resolved.
- Objection (Art. 21) — object to processing based on legitimate interest (e.g., nudge emails). Opt out in Settings.
- Withdraw consent — where processing is based on consent, you may withdraw at any time.
- Lodge a complaint — you may lodge a complaint with your national supervisory authority (e.g. ICO in the UK, CNIL in France, or the Commission for Personal Data Protection in Bulgaria).
We respond to rights requests within 30 days. To exercise any right: privacy@vantum.cc
8. Security
Passwords are hashed with bcrypt (cost factor 12). All connections are TLS-encrypted. Session tokens are HTTP-only and not accessible to JavaScript. We use row-level Neon database isolation. We notify affected users within 72 hours of becoming aware of a data breach, as required by GDPR Art. 33.
9. Changes to this policy
We will post any material changes here and update the “Last updated” date. Continued use after changes constitutes acceptance.
10. Contact
Data protection queries: privacy@vantum.cc
General support: support@vantum.cc